The experience might be better right up until you're running it in prod and someone happens to ask about: Cert revocation (or even expiration) Sudo role

The experience might be better right up until you're running it in prod and someone happens to ask about: Cert revocation (or even expiration) Sudo roles User removal and process termination Is the cert server HA and locked down How you log in when the cert server is down or under attack (rich target!) How to easily add Alice to server group A, Bob to B, and Carlos to both A and B, and then to remove them.. (disclaimer we're celebrating our 15th anniversary at https://Userify.com https://Userify.com, but those are actually legit concerns and not only a sales pitch. You certainly can build a solid and secure ssh cert infra, but doing it in production is just not an easy set-it-and-forget-it sort of thing.)